The vulnerability of the Stylesheet sub-component of the PeopleSoft Enterprise PeopleTools business application package from Oracle PeopleSoft Enterprise allows a hacker to gain access to modify, add, or delete data.

The vulnerability of the Stylesheet sub-component of the PeopleSoft Enterprise PeopleTools business application package from Oracle PeopleSoft Enterprise is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify,...

The vulnerability of the Loan Calculator sub-component of the Oracle Banking Digital Experience component in the bank analytics system’s simulation model, allowing a perpetrator to access the ability to modify, add, or delete data.

The vulnerability of the Loan Calculator sub-component of the Oracle Banking Digital Experience component of the banking analytics system’s simulation model, Oracle Financial Services Applications, is related to lack of access control. Exploiting this vulnerability could allow a malicious actor t...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

DEBIAN-CVE-2019-10079

Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

Phorpiex Botnet Shifts Gears From Ransomware to Sextortion

A recent wide-scale campaign indicates that a decade-old botnet is shifting gears from distributing ransomware to delivering millions of sextortion threats to innocent recipients. Worse, researchers say that the botnet’s spam campaign can affect up to 27 million potential victims. The botnet,...

CVE-2019-3025

Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications. The supported version that is affected is 5.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality RES 3700. While the...

CVE-2019-3012

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: BI Platform Security. Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network...

CVE-2019-2932

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Tree Manager. Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using HEADERS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

Oracle JDeveloper and ADF Unauthorized Access Vulnerability

Oracle JDeveloper is an integrated development environment that provides end-to-end support for modeling, developing, debugging, optimizing, and deploying Java applications and Web services.Oracle ADF is an end-to-end Java EE framework that simplifies application development by providing...

The vulnerability of syntactic analysis in HTTP/1 and the HTTP accelerator Varnish allows attackers to induce a service failure.

The vulnerability of syntactic analysis in HTTP/1 and HTTP accelerator Varnish exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2019-3655 · Oracle +4 · Java Se +6

Name of the Vulnerable Software and Affected Versions: Java SE versions 8u221 Java SE Embedded versions 8u221 Description: The issue is related to inadequate access control in the Deployment component of Oracle Java SE and Java SE Embedded. This could allow a remote attacker to modify, add, or...

HTTP/2: flood using PRIORITY frames results in excessive resource consumption

A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability...

GHSA-P979-4MFW-53VG HTTP Request Smuggling in Netty

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers such as a "Transfer-Encoding : chunked" line, which leads to HTTP request smuggling...

CVE-2019-17320

NetSarang XFTP Client 6.0149 and earlier version contains a buffer overflow vulnerability caused by improper boundary checks when copying file name from an attacker controlled FTP server. That leads attacker to execute arbitrary code by sending a crafted filename...

Cisco Firepower Management Center Path Traversal Vulnerability

Cisco Firepower Management Center FMC is a new generation of firewall management center software from Cisco. A path traversal vulnerability exists in the web-based management interface in Cisco Firepower Management Center FMC, which can be exploited by a remote attacker to bypass the security...

Cisco Unified Communications Manager WEB Interface Security Bypass Vulnerability

Cisco Unified Communications Manager is a unified communications solution. A security bypass vulnerability exists in the way the Cisco Unified Communications Manager WEB interface handles malformed HTTP, which could be exploited by remote attackers to submit a special request that could bypass...

HTTP/2: flood using empty frames results in excessive resource consumption

A flaw was found in HTTP/2. Using frames with an empty payload, a flood could occur that results in excessive CPU usage and starvation of other clients. The highest threat from this vulnerability is to system availability...